Erich Blume ce1f696bd8 Add Reference section with 24 technical reference cards

Phase 2 of documentation restructuring. Creates docs/reference/ with:

Services (16):
- alloy, argocd, borgmatic, 1password, forgejo, grafana
- jellyfin, kiwix, loki, miniflux, navidrome, postgresql
- prometheus, teslamate, transmission, zot

Infrastructure (3):
- hosts - Device inventory
- tailscale - ACLs, groups, tags
- routing - DNS domains and port mappings

Kubernetes (2):
- cluster - Minikube specs
- apps - ArgoCD application registry

Storage (2):
- sifaka - Synology NAS configuration
- backups - Backup policy

All cards use wiki-links for cross-referencing and include YAML
frontmatter with title and tags for Quartz.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-03 13:22:19 -08:00

1.9 KiB

Raw Blame History

title

Tailscale

Tailnet tail8d86e.ts.net provides secure networking for all BlumeOps infrastructure.

ACL Management

ACLs managed via Pulumi in pulumi/policy.hujson.

mise run tailnet-preview   # Preview changes
mise run tailnet-up        # Apply changes

Groups

Group	Members	Purpose
`group:allisonflix`	admin, member	services/jellyfin media access

Device Tags

Tag	Devices	Purpose
`tag:homelab`	indri	Server infrastructure
`tag:nas`	sifaka	Network-attached storage
`tag:blumeops`	indri, sifaka	Pulumi IaC managed resources
`tag:registry`	indri	Container registry access
`tag:k8s-api`	indri	Kubernetes API server access

Important: Don't tag user-owned devices (like gilbert). Tagging converts them to "tagged devices" which lose user identity and break user-based SSH rules.

Access Matrix

Source	Kiwix	Forge	PyPI	Miniflux	PostgreSQL	NAS	Grafana	Loki
`autogroup:admin`	Y	Y	Y	Y	Y	Y	Y	Y
`autogroup:member`	Y	Y	Y	Y	Y	-	-	-
`tag:homelab`	-	-	-	-	-	Y	-	-

Admins - full access to all services
Members - member services only, no Grafana/Loki/NAS

SSH Access

Source	Destinations	Auth
`autogroup:member`	`autogroup:self`	check
`autogroup:admin`	`tag:homelab`	check (12h)
`autogroup:admin`	`tag:nas`	check (12h)

OAuth Credentials

Pulumi uses OAuth client from 1Password (blumeops vault):

Scopes: acl, dns, devices, services
Auto-applies tag:blumeops to IaC-managed resources

infrastructure/routing - Service URLs
infrastructure/hosts - Device inventory

1.9 KiB Raw Blame History